Sri Lanka's Digital ID Project: A Foreign System Integrator's Overreach
Sri Lanka's digital ID project raises concerns over data sovereignty and control. Discover the risks and potential legal challenges. Learn why now.
Key Takeaways
- The role of a foreign master system integrator in Sri Lanka's digital ID project raises significant data sovereignty and security concerns.
- Legal and regulatory challenges, including potential data leakage and arbitration processes, are major hurdles.
- The project's alignment with existing laws and systems, such as the e-NIC, is unclear and poses governance issues.
The Controversy Surrounding Sri Lanka's Digital ID Project
Sri Lanka's ambitious digital identity (SL-UDI) project has been met with significant skepticism and concern, particularly over the role of a foreign master system integrator (MSI). The project, which aims to provide citizens with a unique digital identifier, is seen by many as a potential threat to data sovereignty and national security.
Data Sovereignty at Stake
The Department for Registration of Persons (DRP) has voiced strong reservations about the foreign MSI's control over sensitive data and profile management. P.T.G. Perera, the Acting Project Director of Sri Lanka’s electronic national identity card (e-NIC) project, has raised 22 specific concerns in a letter to the Digital Economy Ministry. These concerns include the potential for data leakage, restricted bidding to Indian companies, and the arbitration process being conducted in New Delhi, effectively bypassing Sri Lanka’s judicial system.
Key issues include:
- Data Control**: The MSI would have significant control over critical security components, potentially undermining established oversight and data security protocols.
- Legal Frameworks**: The project lacks clear legal frameworks for certain biometric data collection, such as iris scans, which could lead to legal and regulatory challenges.
- Data Migration**: The process of migrating data to the new system poses risks of data leakage and loss, especially if not properly managed.
Legal and Governance Challenges
The Supreme Court is set to consider a petition challenging the India-Sri Lanka Memorandum of Understanding (MoU) related to the SL-UDI project. This legal challenge underscores the ongoing concerns over the project's alignment with existing laws and systems. The 1968 Number 32 Persons Registration Act, which provides for the registration of all citizens and the issuance of National Identity Cards, is a key legal framework that the DRP must adhere to.
Overlaps and Governance Issues
Perera’s letter highlights overlaps with existing systems, such as the e-NIC, and warns that the MSI’s management of IT assets could disrupt current governance and security protocols. The limitation of liability clause, which restricts the contractor’s liability to only 10% of the contract value in cases of data breaches, further exacerbates the risks for the Sri Lankan government.
The Role of the Attorney General
The DRP has emphasized the need for the Attorney General’s clearance before signing off on the project. This step is crucial to ensure that the project complies with all legal and regulatory requirements and does not undermine national data sovereignty.
Projections suggest a 30% increase in legal and regulatory scrutiny for digital identity projects in South Asia due to these concerns.
The Bottom Line
Sri Lanka's digital ID project is a double-edged sword. While it has the potential to streamline digital transactions and interactions, the involvement of a foreign MSI raises significant concerns over data sovereignty and security. The legal and governance challenges must be addressed to ensure that the project serves the best interests of the Sri Lankan people without compromising national security.
Frequently Asked Questions
What is the primary concern with the foreign MSI in Sri Lanka's digital ID project?
The primary concern is the potential for the MSI to have significant control over sensitive data and profile management, which could undermine data sovereignty and security.
Why is the 1968 Number 32 Persons Registration Act important in this context?
The 1968 Number 32 Persons Registration Act is crucial because it provides the legal framework for the registration of all citizens and the issuance of National Identity Cards, which the DRP must adhere to.
What are the legal challenges facing the SL-UDI project?
The project faces legal challenges, including a petition challenging the India-Sri Lanka MoU, concerns over data leakage, and the limited liability clause for data breaches.
How does the e-NIC project overlap with the SL-UDI initiative?
The e-NIC project overlaps with the SL-UDI initiative, and the MSI’s management of IT assets could disrupt current governance and security protocols.
Why is the Attorney General’s clearance necessary for the project?
The Attorney General’s clearance is necessary to ensure that the project complies with all legal and regulatory requirements and does not compromise national data sovereignty.
